@serve.zone/dcrouter 18.0.1 → 18.1.0

package/dist_ts/opsserver/handlers/index.d.ts

@@ -21,6 +21,7 @@ export * from './dns-authority.handler.js';
 export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';
+export * from './smtp-account.handler.js';
 export * from './gatewayclient.handler.js';
 export * from './realtime.handler.js';
 export * from './config-event.handler.js';

package/dist_ts/opsserver/handlers/index.js

@@ -21,9 +21,10 @@ export * from './dns-authority.handler.js';
 export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';
+export * from './smtp-account.handler.js';
 export * from './gatewayclient.handler.js';
 export * from './realtime.handler.js';
 export * from './config-event.handler.js';
 export * from './webpush-control.handler.js';
 export * from './webpush-app.handler.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9vcHNzZXJ2ZXIvaGFuZGxlcnMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYywwQkFBMEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9vcHNzZXJ2ZXIvaGFuZGxlcnMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLDBCQUEwQixDQUFDIn0=

package/dist_ts/opsserver/handlers/smtp-account.handler.d.ts

@@ -0,0 +1,20 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../dist_ts_interfaces/index.js';
+/**
+ * CRUD handler for operator-managed SMTP submission accounts, plus the
+ * legacy-route retirement lever.
+ *
+ * Auth: admin JWT or API token with `smtp-accounts:read` / `smtp-accounts:write`
+ * scope; every write additionally requires an admin identity when a JWT is
+ * used. Successful admin actions are audit-logged to the ops log.
+ */
+export declare class SmtpAccountHandler {
+    private opsServerRef;
+    typedrouter: plugins.typedrequest.TypedRouter<interfaces.typedrequestInterfaces.ITypedRequest>;
+    constructor(opsServerRef: OpsServer);
+    private requireAuth;
+    private get manager();
+    private failure;
+    private registerHandlers;
+}

package/dist_ts/opsserver/handlers/smtp-account.handler.js

@@ -0,0 +1,155 @@
+import * as plugins from '../../plugins.js';
+import * as interfaces from '../../../dist_ts_interfaces/index.js';
+import { requireOpsAuth } from '../helpers/auth.js';
+import { logger } from '../../logger.js';
+/**
+ * CRUD handler for operator-managed SMTP submission accounts, plus the
+ * legacy-route retirement lever.
+ *
+ * Auth: admin JWT or API token with `smtp-accounts:read` / `smtp-accounts:write`
+ * scope; every write additionally requires an admin identity when a JWT is
+ * used. Successful admin actions are audit-logged to the ops log.
+ */
+export class SmtpAccountHandler {
+    opsServerRef;
+    typedrouter = new plugins.typedrequest.TypedRouter();
+    constructor(opsServerRef) {
+        this.opsServerRef = opsServerRef;
+        this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+        this.registerHandlers();
+    }
+    async requireAuth(request, requiredScope) {
+        const auth = await requireOpsAuth(this.opsServerRef, request, {
+            scope: requiredScope,
+            requireAdminIdentity: requiredScope.endsWith(':write'),
+        });
+        return auth.userId;
+    }
+    get manager() {
+        return this.opsServerRef.dcRouterRef.smtpAccountManager;
+    }
+    failure(errorArg, fallbackMessageArg) {
+        return {
+            success: false,
+            message: errorArg instanceof Error ? errorArg.message : fallbackMessageArg,
+            code: 'SMTP_ACCOUNT_ACTION_FAILED',
+        };
+    }
+    registerHandlers() {
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('getSmtpAccounts', async (dataArg) => {
+            await this.requireAuth(dataArg, 'smtp-accounts:read');
+            if (!this.manager?.isStarted())
+                return { accounts: [] };
+            return { accounts: await this.manager.listAccounts() };
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('createSmtpAccount', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            if (!this.manager?.isStarted()) {
+                return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                const result = await this.manager.createAccount({
+                    username: dataArg.username,
+                    description: dataArg.description,
+                    senderScope: dataArg.senderScope,
+                    recipientScope: dataArg.recipientScope,
+                    mailPolicy: dataArg.mailPolicy,
+                    createdBy: userId,
+                });
+                return {
+                    success: true,
+                    warnings: result.warnings.length > 0 ? result.warnings : undefined,
+                    account: result.account,
+                    password: result.password,
+                };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to create SMTP account');
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('updateSmtpAccount', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            if (!this.manager?.isStarted()) {
+                return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                const result = await this.manager.updateAccount(dataArg.id, {
+                    description: dataArg.description,
+                    senderScope: dataArg.senderScope,
+                    recipientScope: dataArg.recipientScope,
+                    mailPolicy: dataArg.mailPolicy,
+                }, userId);
+                return {
+                    success: true,
+                    warnings: result.warnings.length > 0 ? result.warnings : undefined,
+                    account: result.account,
+                };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to update SMTP account');
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('toggleSmtpAccount', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            if (!this.manager?.isStarted()) {
+                return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                const result = await this.manager.toggleAccount(dataArg.id, dataArg.enabled, userId);
+                return { success: true, account: result.account };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to toggle SMTP account');
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('rotateSmtpAccountPassword', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            if (!this.manager?.isStarted()) {
+                return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                const result = await this.manager.rotatePassword(dataArg.id, userId);
+                return { success: true, account: result.account, password: result.password };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to rotate SMTP account password');
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('deleteSmtpAccount', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            if (!this.manager?.isStarted()) {
+                return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                await this.manager.deleteAccount(dataArg.id, userId);
+                return { success: true };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to delete SMTP account');
+            }
+        }));
+        // Internal-relay retirement lever: removes one persisted legacy route by
+        // exact name through the standard settings restart path. Guarded in
+        // EmailSettingsManager (unknown names and generated managed names fail).
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('removeLegacyEmailRoute', async (dataArg) => {
+            const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+            const routeName = (dataArg.routeName || '').trim();
+            logger.log('info', `removeLegacyEmailRoute invoked by ${userId} for route '${routeName}'`);
+            if (!routeName) {
+                return { success: false, message: 'routeName is required', code: 'SMTP_ACCOUNT_ACTION_FAILED' };
+            }
+            if (!this.opsServerRef.dcRouterRef.emailSettingsManager) {
+                return { success: false, message: 'EmailSettingsManager not initialized', code: 'EMAIL_SETTINGS_MANAGER_UNAVAILABLE' };
+            }
+            try {
+                await this.opsServerRef.dcRouterRef.updateEmailServerSettings({ removeRouteNames: [routeName] }, userId);
+                logger.log('info', `Legacy email route '${routeName}' removed from persisted settings by ${userId}`);
+                return { success: true, message: `Route '${routeName}' removed` };
+            }
+            catch (err) {
+                return this.failure(err, 'Failed to remove legacy email route');
+            }
+        }));
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic210cC1hY2NvdW50LmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9vcHNzZXJ2ZXIvaGFuZGxlcnMvc210cC1hY2NvdW50LmhhbmRsZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEtBQUssVUFBVSxNQUFNLGlDQUFpQyxDQUFDO0FBQzlELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNwRCxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFekM7Ozs7Ozs7R0FPRztBQUNILE1BQU0sT0FBTyxrQkFBa0I7SUFHVDtJQUZiLFdBQVcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFNUQsWUFBb0IsWUFBdUI7UUFBdkIsaUJBQVksR0FBWixZQUFZLENBQVc7UUFDekMsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUMvRCxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUMxQixDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FDdkIsT0FBb0UsRUFDcEUsYUFBNkM7UUFFN0MsTUFBTSxJQUFJLEdBQUcsTUFBTSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxPQUFPLEVBQUU7WUFDNUQsS0FBSyxFQUFFLGFBQWE7WUFDcEIsb0JBQW9CLEVBQUUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7U0FDdkQsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxJQUFZLE9BQU87UUFDakIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQztJQUMxRCxDQUFDO0lBRU8sT0FBTyxDQUFDLFFBQWlCLEVBQUUsa0JBQTBCO1FBQzNELE9BQU87WUFDTCxPQUFPLEVBQUUsS0FBSztZQUNkLE9BQU8sRUFBRSxRQUFRLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxrQkFBa0I7WUFDMUUsSUFBSSxFQUFFLDRCQUE0QjtTQUNuQyxDQUFDO0lBQ0osQ0FBQztJQUVPLGdCQUFnQjtRQUN0QixJQUFJLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FDOUIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDbkMsaUJBQWlCLEVBQ2pCLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoQixNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLG9CQUFvQixDQUFDLENBQUM7WUFDdEQsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFO2dCQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUM7WUFDeEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUN6RCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLG1CQUFtQixFQUNuQixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxvQ0FBb0MsRUFBRSxJQUFJLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztZQUNySCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUM7b0JBQzlDLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUTtvQkFDMUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXO29CQUNoQyxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7b0JBQ2hDLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztvQkFDdEMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO29CQUM5QixTQUFTLEVBQUUsTUFBTTtpQkFDbEIsQ0FBQyxDQUFDO2dCQUNILE9BQU87b0JBQ0wsT0FBTyxFQUFFLElBQUk7b0JBQ2IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUztvQkFDbEUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO29CQUN2QixRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7aUJBQzFCLENBQUM7WUFDSixDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSwrQkFBK0IsQ0FBQyxDQUFDO1lBQzVELENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLG1CQUFtQixFQUNuQixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxvQ0FBb0MsRUFBRSxJQUFJLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztZQUNySCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRTtvQkFDMUQsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXO29CQUNoQyxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7b0JBQ2hDLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztvQkFDdEMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO2lCQUMvQixFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUNYLE9BQU87b0JBQ0wsT0FBTyxFQUFFLElBQUk7b0JBQ2IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUztvQkFDbEUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO2lCQUN4QixDQUFDO1lBQ0osQ0FBQztZQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7Z0JBQ3RCLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsK0JBQStCLENBQUMsQ0FBQztZQUM1RCxDQUFDO1FBQ0gsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQyxtQkFBbUIsRUFDbkIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUscUJBQXFCLENBQUMsQ0FBQztZQUN0RSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsRUFBRSxDQUFDO2dCQUMvQixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsb0NBQW9DLEVBQUUsSUFBSSxFQUFFLGtDQUFrQyxFQUFFLENBQUM7WUFDckgsQ0FBQztZQUNELElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDckYsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNwRCxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSwrQkFBK0IsQ0FBQyxDQUFDO1lBQzVELENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLDJCQUEyQixFQUMzQixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxvQ0FBb0MsRUFBRSxJQUFJLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztZQUNySCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDckUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMvRSxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSx3Q0FBd0MsQ0FBQyxDQUFDO1lBQ3JFLENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLG1CQUFtQixFQUNuQixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxvQ0FBb0MsRUFBRSxJQUFJLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztZQUNySCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDckQsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztZQUMzQixDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSwrQkFBK0IsQ0FBQyxDQUFDO1lBQzVELENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYseUVBQXlFO1FBQ3pFLG9FQUFvRTtRQUNwRSx5RUFBeUU7UUFDekUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLHdCQUF3QixFQUN4QixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RFLE1BQU0sU0FBUyxHQUFHLENBQUMsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxxQ0FBcUMsTUFBTSxlQUFlLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDM0YsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO2dCQUNmLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxJQUFJLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQztZQUNsRyxDQUFDO1lBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3hELE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxzQ0FBc0MsRUFBRSxJQUFJLEVBQUUsb0NBQW9DLEVBQUUsQ0FBQztZQUN6SCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMseUJBQXlCLENBQzNELEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxFQUNqQyxNQUFNLENBQ1AsQ0FBQztnQkFDRixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSx1QkFBdUIsU0FBUyx3Q0FBd0MsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDckcsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLFVBQVUsU0FBUyxXQUFXLEVBQUUsQ0FBQztZQUNwRSxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxxQ0FBcUMsQ0FBQyxDQUFDO1lBQ2xFLENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztDQUNGIn0=

package/dist_ts_interfaces/data/email-settings.d.ts

@@ -34,6 +34,10 @@ export interface IEmailServerSettings {
     domainCount: number;
     routeCount: number;
     authUserCount: number;
+    /** Operator-managed SMTP submission accounts (hashed credentials, DB-backed). */
+    smtpAccountCount?: number;
+    /** Present when the email server is running: whether the SMTP listener is accepting connections. */
+    smtpListenerActive?: boolean;
     /** Present when outboundMode is 'remoteIngress': whether a mail egress edge is currently available. */
     outboundEgress?: IEmailOutboundEgressStatus;
     /** Present when the email server is running: current state of the Rust mailer bridge. */
@@ -55,4 +59,10 @@ export type TEmailServerSettingsUpdate = {
     portMapping?: Record<number, number> | null;
     receivedEmailsPath?: string | null;
     maxMessageSize?: number | null;
+    /**
+     * Exact names of persisted legacy routes to remove (the internal-relay
+     * retirement lever). Fails loudly on unknown names and refuses generated
+     * managed routes ('workapp-mail-*', 'smtp-account-*').
+     */
+    removeRouteNames?: string[];
 };

package/dist_ts_interfaces/data/index.d.ts

@@ -12,5 +12,6 @@ export * from './dns-record.js';
 export * from './acme-config.js';
 export * from './email-domain.js';
 export * from './email-settings.js';
+export * from './smtp-account.js';
 export * from './security-policy.js';
 export * from './config-events.js';

package/dist_ts_interfaces/data/index.js

@@ -12,6 +12,7 @@ export * from './dns-record.js';
 export * from './acme-config.js';
 export * from './email-domain.js';
 export * from './email-settings.js';
+export * from './smtp-account.js';
 export * from './security-policy.js';
 export * from './config-events.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19pbnRlcmZhY2VzL2RhdGEvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsb0JBQW9CLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19pbnRlcmZhY2VzL2RhdGEvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxvQkFBb0IsQ0FBQyJ9

package/dist_ts_interfaces/data/route-management.d.ts

@@ -12,7 +12,7 @@ export interface IRouteSecurity extends TSmartProxyRouteSecurityBase {
     rateLimit?: IRouteRateLimit | null;
     challenge?: IRouteChallengeConfig | null;
 }
-export declare const apiTokenScopes: readonly ["*", "routes:read", "routes:write", "config:read", "stats:read", "logs:read", "config-events:read", "config-events:write", "security:read", "security:write", "emails:read", "emails:write", "certificates:read", "certificates:write", "tokens:read", "tokens:manage", "users:read", "users:manage", "source-profiles:read", "source-profiles:write", "target-profiles:read", "target-profiles:write", "targets:read", "targets:write", "dns-providers:read", "dns-providers:write", "domains:read", "domains:write", "dns-authority:read", "dns-authority:write", "dns-records:read", "dns-records:write", "acme-config:read", "acme-config:write", "email-domains:read", "email-domains:write", "remote-ingress:read", "remote-ingress:write", "vpn:read", "vpn:write", "radius:read", "radius:write", "gateway-clients:read", "gateway-clients:write", "workhosters:read", "workhosters:write"];
+export declare const apiTokenScopes: readonly ["*", "routes:read", "routes:write", "config:read", "stats:read", "logs:read", "config-events:read", "config-events:write", "security:read", "security:write", "emails:read", "emails:write", "certificates:read", "certificates:write", "tokens:read", "tokens:manage", "users:read", "users:manage", "source-profiles:read", "source-profiles:write", "target-profiles:read", "target-profiles:write", "targets:read", "targets:write", "dns-providers:read", "dns-providers:write", "domains:read", "domains:write", "dns-authority:read", "dns-authority:write", "dns-records:read", "dns-records:write", "acme-config:read", "acme-config:write", "email-domains:read", "email-domains:write", "smtp-accounts:read", "smtp-accounts:write", "remote-ingress:read", "remote-ingress:write", "vpn:read", "vpn:write", "radius:read", "radius:write", "gateway-clients:read", "gateway-clients:write", "workhosters:read", "workhosters:write"];
 export type TApiTokenScope = typeof apiTokenScopes[number];
 export type TGatewayClientType = 'onebox' | 'cloudly' | 'custom';
 export interface IApiTokenPolicy {

package/dist_ts_interfaces/data/route-management.js

@@ -38,6 +38,8 @@ export const apiTokenScopes = [
     'acme-config:write',
     'email-domains:read',
     'email-domains:write',
+    'smtp-accounts:read',
+    'smtp-accounts:write',
     'remote-ingress:read',
     'remote-ingress:write',
     'vpn:read',
@@ -122,4 +124,4 @@ export function canonicalizeSourceRouteId(routeId) {
     const sourceVariantIndex = routeId.indexOf(':source:');
     return sourceVariantIndex === -1 ? routeId : routeId.slice(0, sourceVariantIndex);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUtbWFuYWdlbWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvZGF0YS9yb3V0ZS1tYW5hZ2VtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFCQSwrRUFBK0U7QUFDL0UsOEJBQThCO0FBQzlCLCtFQUErRTtBQUUvRSxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUc7SUFDNUIsR0FBRztJQUNILGFBQWE7SUFDYixjQUFjO0lBQ2QsYUFBYTtJQUNiLFlBQVk7SUFDWixXQUFXO0lBQ1gsb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixlQUFlO0lBQ2YsZ0JBQWdCO0lBQ2hCLGFBQWE7SUFDYixjQUFjO0lBQ2QsbUJBQW1CO0lBQ25CLG9CQUFvQjtJQUNwQixhQUFhO0lBQ2IsZUFBZTtJQUNmLFlBQVk7SUFDWixjQUFjO0lBQ2Qsc0JBQXNCO0lBQ3RCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsdUJBQXVCO0lBQ3ZCLGNBQWM7SUFDZCxlQUFlO0lBQ2Ysb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixjQUFjO0lBQ2QsZUFBZTtJQUNmLG9CQUFvQjtJQUNwQixxQkFBcUI7SUFDckIsa0JBQWtCO0lBQ2xCLG1CQUFtQjtJQUNuQixrQkFBa0I7SUFDbEIsbUJBQW1CO0lBQ25CLG9CQUFvQjtJQUNwQixxQkFBcUI7SUFDckIscUJBQXFCO0lBQ3JCLHNCQUFzQjtJQUN0QixVQUFVO0lBQ1YsV0FBVztJQUNYLGFBQWE7SUFDYixjQUFjO0lBQ2Qsc0JBQXNCO0lBQ3RCLHVCQUF1QjtJQUN2QixrQkFBa0I7SUFDbEIsbUJBQW1CO0NBQ1gsQ0FBQztBQWlGWCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRztJQUM5QixnQkFBZ0I7SUFDaEIsUUFBUTtJQUNSLGFBQWE7SUFDYixnQkFBZ0I7SUFDaEIsS0FBSztJQUNMLFNBQVM7Q0FDRCxDQUFDO0FBSVgsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQW9DO0lBQ3hFLGdCQUFnQixFQUFFLGdCQUFnQjtJQUNsQyxNQUFNLEVBQUUsZUFBZTtJQUN2QixhQUFhLEVBQUUsYUFBYTtJQUM1QixnQkFBZ0IsRUFBRSxnQkFBZ0I7SUFDbEMsR0FBRyxFQUFFLFdBQVc7SUFDaEIsT0FBTyxFQUFFLFVBQVU7Q0FDcEIsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFzQztJQUM1RSxnQkFBZ0IsRUFBRTtRQUNoQixvQkFBb0I7UUFDcEIsMEJBQTBCO1FBQzFCLDJCQUEyQjtRQUMzQixtQkFBbUI7UUFDbkIscUJBQXFCO0tBQ3RCO0lBQ0QsTUFBTSxFQUFFO1FBQ04sV0FBVztRQUNYLFlBQVk7UUFDWixpQkFBaUI7UUFDakIsZ0JBQWdCO1FBQ2hCLFFBQVE7UUFDUixRQUFRO1FBQ1IsT0FBTztRQUNQLFVBQVU7UUFDVixjQUFjO0tBQ2Y7SUFDRCxhQUFhLEVBQUUsRUFBRTtJQUNqQixnQkFBZ0IsRUFBRTtRQUNoQixZQUFZO1FBQ1osU0FBUztRQUNULFdBQVc7UUFDWCxRQUFRO1FBQ1IsVUFBVTtRQUNWLFNBQVM7UUFDVCxnQkFBZ0I7UUFDaEIsWUFBWTtRQUNaLGVBQWU7UUFDZixZQUFZO1FBQ1osWUFBWTtRQUNaLGVBQWU7UUFDZixhQUFhO1FBQ2IsWUFBWTtRQUNaLGVBQWU7UUFDZixjQUFjO1FBQ2QsZUFBZTtLQUNoQjtJQUNELEdBQUcsRUFBRTtRQUNILFlBQVk7UUFDWixZQUFZO0tBQ2I7SUFDRCxPQUFPLEVBQUU7UUFDUCxnQkFBZ0I7UUFDaEIsMEJBQTBCO0tBQzNCO0NBQ0YsQ0FBQztBQW1ERiwrRUFBK0U7QUFDL0UsdUJBQXVCO0FBQ3ZCLCtFQUErRTtBQUUvRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLDRCQUE0QixDQUFVLENBQUM7QUFnR3pFLGdGQUFnRjtBQUNoRixNQUFNLFVBQVUseUJBQXlCLENBQUMsT0FBZTtJQUN2RCxNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdkQsT0FBTyxrQkFBa0IsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0FBQ3BGLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUtbWFuYWdlbWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvZGF0YS9yb3V0ZS1tYW5hZ2VtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFCQSwrRUFBK0U7QUFDL0UsOEJBQThCO0FBQzlCLCtFQUErRTtBQUUvRSxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUc7SUFDNUIsR0FBRztJQUNILGFBQWE7SUFDYixjQUFjO0lBQ2QsYUFBYTtJQUNiLFlBQVk7SUFDWixXQUFXO0lBQ1gsb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixlQUFlO0lBQ2YsZ0JBQWdCO0lBQ2hCLGFBQWE7SUFDYixjQUFjO0lBQ2QsbUJBQW1CO0lBQ25CLG9CQUFvQjtJQUNwQixhQUFhO0lBQ2IsZUFBZTtJQUNmLFlBQVk7SUFDWixjQUFjO0lBQ2Qsc0JBQXNCO0lBQ3RCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsdUJBQXVCO0lBQ3ZCLGNBQWM7SUFDZCxlQUFlO0lBQ2Ysb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixjQUFjO0lBQ2QsZUFBZTtJQUNmLG9CQUFvQjtJQUNwQixxQkFBcUI7SUFDckIsa0JBQWtCO0lBQ2xCLG1CQUFtQjtJQUNuQixrQkFBa0I7SUFDbEIsbUJBQW1CO0lBQ25CLG9CQUFvQjtJQUNwQixxQkFBcUI7SUFDckIsb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixxQkFBcUI7SUFDckIsc0JBQXNCO0lBQ3RCLFVBQVU7SUFDVixXQUFXO0lBQ1gsYUFBYTtJQUNiLGNBQWM7SUFDZCxzQkFBc0I7SUFDdEIsdUJBQXVCO0lBQ3ZCLGtCQUFrQjtJQUNsQixtQkFBbUI7Q0FDWCxDQUFDO0FBaUZYLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHO0lBQzlCLGdCQUFnQjtJQUNoQixRQUFRO0lBQ1IsYUFBYTtJQUNiLGdCQUFnQjtJQUNoQixLQUFLO0lBQ0wsU0FBUztDQUNELENBQUM7QUFJWCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBb0M7SUFDeEUsZ0JBQWdCLEVBQUUsZ0JBQWdCO0lBQ2xDLE1BQU0sRUFBRSxlQUFlO0lBQ3ZCLGFBQWEsRUFBRSxhQUFhO0lBQzVCLGdCQUFnQixFQUFFLGdCQUFnQjtJQUNsQyxHQUFHLEVBQUUsV0FBVztJQUNoQixPQUFPLEVBQUUsVUFBVTtDQUNwQixDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQXNDO0lBQzVFLGdCQUFnQixFQUFFO1FBQ2hCLG9CQUFvQjtRQUNwQiwwQkFBMEI7UUFDMUIsMkJBQTJCO1FBQzNCLG1CQUFtQjtRQUNuQixxQkFBcUI7S0FDdEI7SUFDRCxNQUFNLEVBQUU7UUFDTixXQUFXO1FBQ1gsWUFBWTtRQUNaLGlCQUFpQjtRQUNqQixnQkFBZ0I7UUFDaEIsUUFBUTtRQUNSLFFBQVE7UUFDUixPQUFPO1FBQ1AsVUFBVTtRQUNWLGNBQWM7S0FDZjtJQUNELGFBQWEsRUFBRSxFQUFFO0lBQ2pCLGdCQUFnQixFQUFFO1FBQ2hCLFlBQVk7UUFDWixTQUFTO1FBQ1QsV0FBVztRQUNYLFFBQVE7UUFDUixVQUFVO1FBQ1YsU0FBUztRQUNULGdCQUFnQjtRQUNoQixZQUFZO1FBQ1osZUFBZTtRQUNmLFlBQVk7UUFDWixZQUFZO1FBQ1osZUFBZTtRQUNmLGFBQWE7UUFDYixZQUFZO1FBQ1osZUFBZTtRQUNmLGNBQWM7UUFDZCxlQUFlO0tBQ2hCO0lBQ0QsR0FBRyxFQUFFO1FBQ0gsWUFBWTtRQUNaLFlBQVk7S0FDYjtJQUNELE9BQU8sRUFBRTtRQUNQLGdCQUFnQjtRQUNoQiwwQkFBMEI7S0FDM0I7Q0FDRixDQUFDO0FBbURGLCtFQUErRTtBQUMvRSx1QkFBdUI7QUFDdkIsK0VBQStFO0FBRS9FLE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsNEJBQTRCLENBQVUsQ0FBQztBQWdHekUsZ0ZBQWdGO0FBQ2hGLE1BQU0sVUFBVSx5QkFBeUIsQ0FBQyxPQUFlO0lBQ3ZELE1BQU0sa0JBQWtCLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RCxPQUFPLGtCQUFrQixLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLENBQUM7QUFDcEYsQ0FBQyJ9

package/dist_ts_interfaces/data/smtp-account.d.ts

@@ -0,0 +1,50 @@
+/**
+ * "Send AS who" scope. `addresses` are literal or local-part-wildcard address
+ * patterns (e.g. 'billing@example.com', '*@example.com' is expressed via
+ * `domains` instead); `domains` authorize every address of a domain.
+ * Both lists empty = unrestricted sender scope.
+ */
+export interface ISmtpAccountSenderScope {
+    addresses: string[];
+    domains: string[];
+}
+/** 'any' = unrestricted recipients; 'restricted' = only listed addresses/domains. */
+export type TSmtpRecipientScopeMode = 'any' | 'restricted';
+/** "Send TO who" scope. Lists are only enforced when mode is 'restricted'. */
+export interface ISmtpAccountRecipientScope {
+    mode: TSmtpRecipientScopeMode;
+    addresses: string[];
+    domains: string[];
+}
+/** Per-account outbound mail policy applied to generated relay routes. */
+export interface ISmtpAccountMailPolicy {
+    /** Sign outbound mail with the sender domain's active managed DKIM key. */
+    dkimSign: boolean;
+    /** SmartMTA delivery queue (default 'normal'). */
+    queue?: 'normal' | 'priority' | 'bulk';
+}
+/** Per-sender-domain outbound readiness as reported by EmailDomainManager. */
+export interface ISmtpAccountDomainReadiness {
+    domain: string;
+    ready: boolean;
+    reason?: string;
+}
+/**
+ * Public representation of an SMTP submission account. Never includes the
+ * password or the stored SCRAM verifier.
+ */
+export interface ISmtpAccountInfo {
+    id: string;
+    username: string;
+    description: string;
+    enabled: boolean;
+    senderScope: ISmtpAccountSenderScope;
+    recipientScope: ISmtpAccountRecipientScope;
+    mailPolicy: ISmtpAccountMailPolicy;
+    createdAt: number;
+    updatedAt: number;
+    createdBy: string;
+    lastRotatedAt?: number;
+    /** Outbound readiness of each sender-scope domain (managed domains only). */
+    domainReadiness?: ISmtpAccountDomainReadiness[];
+}

package/dist_ts_interfaces/data/smtp-account.js

@@ -0,0 +1,9 @@
+// ============================================================================
+// SMTP Account Data Types
+// ============================================================================
+//
+// Operator-managed authenticated SMTP submission accounts. Wire types never
+// carry secrets: passwords are machine-generated, shown exactly once at
+// create/rotate time, and only a hashed SCRAM verifier is persisted.
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic210cC1hY2NvdW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfaW50ZXJmYWNlcy9kYXRhL3NtdHAtYWNjb3VudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrRUFBK0U7QUFDL0UsMEJBQTBCO0FBQzFCLCtFQUErRTtBQUMvRSxFQUFFO0FBQ0YsNEVBQTRFO0FBQzVFLHdFQUF3RTtBQUN4RSxxRUFBcUUifQ==

package/dist_ts_interfaces/requests/index.d.ts

@@ -21,6 +21,7 @@ export * from './dns-records.js';
 export * from './acme-config.js';
 export * from './email-domains.js';
 export * from './email-settings.js';
+export * from './smtp-accounts.js';
 export * from './realtime.js';
 export * from './workhoster.js';
 export * from './security-policy.js';

package/dist_ts_interfaces/requests/index.js

@@ -21,8 +21,9 @@ export * from './dns-records.js';
 export * from './acme-config.js';
 export * from './email-domains.js';
 export * from './email-settings.js';
+export * from './smtp-accounts.js';
 export * from './realtime.js';
 export * from './workhoster.js';
 export * from './security-policy.js';
 export * from './config-events.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19pbnRlcmZhY2VzL3JlcXVlc3RzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG9CQUFvQixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19pbnRlcmZhY2VzL3JlcXVlc3RzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsb0JBQW9CLENBQUMifQ==

package/dist_ts_interfaces/requests/smtp-accounts.d.ts

@@ -0,0 +1,125 @@
+import * as plugins from '../plugins.js';
+import type * as authInterfaces from '../data/auth.js';
+import type { ISmtpAccountInfo, ISmtpAccountMailPolicy, ISmtpAccountRecipientScope, ISmtpAccountSenderScope } from '../data/smtp-account.js';
+/**
+ * Shared mutation result. `warnings` carries non-blocking findings such as
+ * sender domains that are not managed email domains (warn-and-allow).
+ */
+export interface ISmtpAccountActionResult {
+    success: boolean;
+    message?: string;
+    code?: string;
+    warnings?: string[];
+}
+/**
+ * List all SMTP submission accounts (never includes credentials).
+ */
+export interface IReq_GetSmtpAccounts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSmtpAccounts> {
+    method: 'getSmtpAccounts';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+    };
+    response: {
+        accounts: ISmtpAccountInfo[];
+    };
+}
+/**
+ * Create an SMTP submission account. The password is machine-generated and
+ * returned exactly once in this response; only a SCRAM verifier is persisted.
+ */
+export interface IReq_CreateSmtpAccount extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSmtpAccount> {
+    method: 'createSmtpAccount';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        username: string;
+        description?: string;
+        senderScope?: ISmtpAccountSenderScope;
+        recipientScope?: ISmtpAccountRecipientScope;
+        mailPolicy?: ISmtpAccountMailPolicy;
+    };
+    response: ISmtpAccountActionResult & {
+        account?: ISmtpAccountInfo;
+        /** Shown once; never retrievable again. */
+        password?: string;
+    };
+}
+/**
+ * Update an SMTP account's description, scopes, or mail policy.
+ */
+export interface IReq_UpdateSmtpAccount extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_UpdateSmtpAccount> {
+    method: 'updateSmtpAccount';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        id: string;
+        description?: string;
+        senderScope?: ISmtpAccountSenderScope;
+        recipientScope?: ISmtpAccountRecipientScope;
+        mailPolicy?: ISmtpAccountMailPolicy;
+    };
+    response: ISmtpAccountActionResult & {
+        account?: ISmtpAccountInfo;
+    };
+}
+/**
+ * Enable or disable an SMTP account. Disabled accounts always fail
+ * authentication (and still shadow same-named legacy static users).
+ */
+export interface IReq_ToggleSmtpAccount extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ToggleSmtpAccount> {
+    method: 'toggleSmtpAccount';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        id: string;
+        enabled: boolean;
+    };
+    response: ISmtpAccountActionResult & {
+        account?: ISmtpAccountInfo;
+    };
+}
+/**
+ * Rotate an SMTP account's password. The new password is returned exactly
+ * once; the previous credential stops working immediately.
+ */
+export interface IReq_RotateSmtpAccountPassword extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_RotateSmtpAccountPassword> {
+    method: 'rotateSmtpAccountPassword';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        id: string;
+    };
+    response: ISmtpAccountActionResult & {
+        account?: ISmtpAccountInfo;
+        /** Shown once; never retrievable again. */
+        password?: string;
+    };
+}
+/**
+ * Delete an SMTP account.
+ */
+export interface IReq_DeleteSmtpAccount extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_DeleteSmtpAccount> {
+    method: 'deleteSmtpAccount';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        id: string;
+    };
+    response: ISmtpAccountActionResult;
+}
+/**
+ * Remove a named legacy route from the persisted email server settings
+ * (EmailServerSettingsDoc.emailConfig.routes) — the retirement lever for
+ * legacy internal-relay routes once scoped SMTP accounts replace them.
+ * Applies through the standard email settings restart path.
+ */
+export interface IReq_RemoveLegacyEmailRoute extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_RemoveLegacyEmailRoute> {
+    method: 'removeLegacyEmailRoute';
+    request: {
+        identity?: authInterfaces.IIdentity;
+        apiToken?: string;
+        routeName: string;
+    };
+    response: ISmtpAccountActionResult;
+}

package/dist_ts_interfaces/requests/smtp-accounts.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic210cC1hY2NvdW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvcmVxdWVzdHMvc210cC1hY2NvdW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQyJ9